Issue O4 — Staff log and privacy

Summary

Staff access is recorded. The privacy page says so.

Log

• Viewing a phone, marking paid, refunding, waiving, and banning each write actor, case id, and time.
• A concierge cannot export phones.
• Admin export is case id, payer name, amount, and status. No tutor phone.

Privacy line

• Staff see the case in order to introduce and collect the fee.
• We keep the fee row seven years.
• We do not sell the case list.
• A delete request hides the profile. An unpaid or disputed fee is kept until it is closed.

Acceptance

• A phone view has a log row.
• The privacy page contains the four lines above.